EUVD-2026-29099
GHSA-4xxc-9mf8-p66h
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
AV:L because model files must be local; PR:N as attacker distributes files externally; arbitrary code execution justifies C:H/I:H/A:H over the provided C:L/I:L/A:L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its model loading component. The framework uses torch.load() to load model weight files (e.g., llm.pt, flow.pt, hift.pt) without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a malicious model directory containing specially crafted model files. When a victim starts the CosyVoice Web UI pointing to this directory, arbitrary code is executed on the victim's system during the model loading process.
AnalysisAI
Insecure deserialization in CosyVoice's model loading pipeline permits arbitrary code execution on any system that loads a maliciously crafted model directory via the Web UI. The framework invokes torch.load() on model weight files (llm.pt, flow.pt, hift.pt) without the weights_only=True safety parameter, allowing Python's pickle module to deserialize and execute arbitrary objects embedded in those files. An attacker who can persuade a victim to point the CosyVoice Web UI at an attacker-controlled model directory - whether via a trojanized download, a shared malicious repository, or direct filesystem access - achieves code execution on the victim's machine at the moment of model loading. No public exploit code or CISA KEV listing is recorded at time of analysis; EPSS is 0.02% (5th percentile) and SSVC assesses exploitation as none, consistent with the social-engineering precondition required.
Technical ContextAI
CosyVoice is an open-source AI voice synthesis framework (github.com/FunAudioLLM/CosyVoice) that loads PyTorch model checkpoint files using torch.load(). PyTorch's torch.load() defaults to full pickle deserialization, which can reconstruct arbitrary Python objects - including those with __reduce__ methods that execute shell commands - during the load process. The safe API surface is torch.load(f, weights_only=True), which restricts deserialization to tensor primitives only; this parameter was introduced precisely to address the known insecurity of pickle-based model loading. The root-cause CWE listed in the input is CWE-94 (Code Injection), though the description explicitly references CWE-502 (Deserialization of Untrusted Data); both apply since the vector is pickle deserialization producing arbitrary code injection. The vulnerability is present through commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e. CPE data from NVD is listed as n/a, indicating the product has not yet been formally mapped in the National Vulnerability Database.
RemediationAI
The primary fix is to update CosyVoice to a commit or release that patches all torch.load() calls by adding the weights_only=True parameter, which restricts deserialization to safe tensor primitives and prevents pickle-based code execution. No specific patched release version is identified in the available data; monitor the upstream repository at https://github.com/FunAudioLLM/CosyVoice for a fix commit. Until a patch is available, the most effective compensating control is to load model files exclusively from trusted, verified sources - ideally cryptographically signed model archives with checksum verification before loading. Operators should avoid pointing the Web UI at any model directory whose provenance cannot be confirmed. As a secondary control, run the CosyVoice process in an isolated environment (Docker container, VM, or dedicated sandboxed user account) so that even if code executes, lateral movement is constrained. Note that sandboxing does not prevent the initial code execution; it only limits blast radius. For organizations that can tolerate the effort, the underlying fix can be applied locally by patching the model loading code to use torch.load(path, weights_only=True) or by using the safer safetensors format as an alternative model serialization mechanism. See the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-31252 for advisory updates.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today